I use a unique email address for each site I sign up for, and thus Claude/Claude Code doesn't have my 'main' email. And yet after months of use?
Not a single spam to that unique email.
So if this is happening, it doesn't see to be causing even 1 spam email to that address.
Same. I use a custom domain and a salt/nonce so it's not just Anthropic/Claude@example.com. it's something unique that's not trivially guessable. Well, not counting the emails from "Lydia" at Anthropic telling me about new features in Claude, which is spamish, but is from Anthropic and not from elsewhere that they've leaked it to.
Same here. That’s probably because the number of websites that actually harvest email addresses from User-Agent headers to send spam is small, and Claude would need to have actually fetched one of them.